CVE-2026-22857 is a critical heap use after free (CVSS 9.8) in FreeRDP before version 3.20.1. In irp_thread_func, the IRP is freed by irp->Complete() and then used again on the error path, which can corrupt memory. The fix is FreeRDP 3.20.1, so upgrade clients.
What's affected
FreeRDP before 3.20.1. The fixed version is 3.20.1.
The flaw is in irp_thread_func. The record says the IRP is freed by irp->Complete() and then accessed again on the error path.
How to check if you're exposed
Print the version of the client you use, and find other programs on the host that bundle the FreeRDP libraries.
xfreerdp /version
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
Use the line that fits your system. A reported version before 3.20.1 is affected unless your distribution says it backported the fix. Remote desktop front ends and other applications can embed FreeRDP, so check them as well.
What to do now
- Upgrade FreeRDP to 3.20.1 or later, or install your distribution update that carries the fix.
- Update or rebuild any application or container image that bundles the FreeRDP libraries.
- Connect only to RDP servers you trust until every client is updated.
- Where you can, disable redirection channels you do not need in your client settings.
- Add FreeRDP to your software inventory so the next advisory is matched quickly.
Why it matters
The weakness is CWE-416, a use after free. A structure is released, and a later line of code on a less common path still holds a pointer to it. Error paths are where these mistakes tend to hide, because tests rarely reach them.
The record does not describe the trigger further. Use after free flaws can lead to crashes or memory corruption, and the vector rates all three impacts as high with a score of 9.8. The record does not say the flaw is exploited in the wild, and it is not on the CISA KEV list.
The fix is to stop touching the object after it is completed, for example by saving what the error path needs before the call.
Quick check
What is an IRP?
The record uses the term for the request structure in the device redirection code. It is freed when the request completes.
What else did 3.20.1 fix?
Several other FreeRDP flaws, including CVE-2026-22852 and CVE-2026-22854.
Sources
Last reviewed: 19 October 2026.
